Privacy Policy

• To perform your order — create your account, process payment, issue your ticket, and let you attend an Event or use a Venue booking (contract).
• To verify you — phone/email verification, fraud and abuse prevention (contract and legitimate interest).
• To communicate with you — order confirmations, reminders, and support replies (contract); marketing updates only where you have opted in (consent, and you can opt out at any time).
• To operate and improve the Platform — diagnostics, crash reporting, and product analytics (legitimate interest).
• To verify Organizers — identity and payout-account checks before an organizer can receive payouts (legitimate interest and legal obligation, including anti-money-laundering expectations that flow down from our payment providers).
• To comply with the law — tax, payment-provider and law-enforcement requests where applicable (legal obligation).

We do not sell your personal data.

Some of the processors above are located outside Iraq (the EU, the United States). Where that happens, we rely on the safeguards those providers make available (such as their own data-processing agreements) to protect your data in transit and at rest.

• Payment, payout and KYC (organizer identity verification) records: at least 5 years, in line with anti-money-laundering expectations from our payment providers.
• Account and order data: for as long as your account is active, and for a reasonable period after deletion to resolve any pending order, refund, or dispute.
• Support messages and diagnostics: kept only as long as needed to resolve the matter or improve the Platform.

Depending on where you are, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict some processing. To exercise any of these rights, contact us using the details below. If you are in the EU or UK, you also have the right to lodge a complaint with your local data-protection authority.

Account deletion: you can request deletion of your account from Settings or by contacting support. We are working to make sure a deleted account does not reappear if you sign in again through a linked provider (such as Google) — if that ever happens to you, please tell us.

The Platform is not directed at children, and we do not knowingly collect personal data from anyone below the age required to enter into a contract in their jurisdiction.

We take reasonable technical and organizational measures to protect your data, and we are actively working through a security review of our database access controls, identity-document storage, and account-deletion flow. This is a draft policy — we will not describe protections here as complete until that work is done.

We only send marketing messages if you have opted in, and every marketing message includes a way to opt out.

Visitors from the EU, UK or EEA see a cookie-consent banner before Intercom (chat), session replay, or an Organizer's own tracking pixels load; everyone else sees a simple notice with an opt-out. The banner explains what each of these tools does.

The website statistics we collect ourselves (Cloudflare Web Analytics) use no cookies and no local storage, and Cloudflare states that it does not fingerprint visitors for them, so they run for every visitor and are not behind the banner.

We may update this policy as the Platform changes. When we do, we will update the "Last updated" date above.

Questions about this policy, or a request relating to your data:

• Email: support@mkan.co

Draft — pending lawyer review. This policy is grounded in how the Platform actually works today, but has not yet been reviewed by a licensed lawyer, and will be updated once it has.